servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0. Upstream patch: https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=0cee1ffb6021b1aae3fcc9581699da1c85a6dd6e
Created openldap tracking bugs for this issue: Affects: fedora-all [bug 1456713]
External References: http://www.openldap.org/its/?findid=8655
Statement: This issue does not affect the versions of OpenLDAP as shipped with Red Hat Enterprise Linux 6 and 7 as they don't use the affected MDB backend in their default configurations. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:1852 https://access.redhat.com/errata/RHSA-2017:1852